Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agent
Comments on “Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agent”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A new arXiv paper finds that coding agents which flatten chat history into one text string before compaction let anything the agent reads forge a "[User]:" line that survives as a user instruction. Across pi, opencode, Cline, Aider and OpenHands this happened 87–100% of the time, versus 0% in four role-typed harnesses. Live in pi, attacker code ran in 3 of 6 poisoned sessions and 0 of 5 clean ones. Escaping role labels is the proposed fix; a code-level check caught 77%.
Why it ranked
No. 3 of 124 with a score of 0.77. The panel rated it highest on technical depth (0.94) and new information (0.93), lowest on audience breadth (0.67).
Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.2
- Significance0.73
- Reader interest0.85
- Audience breadth0.67
- Practical relevance0.84
- Substantiated0.86
- Technical depth0.94
- New information0.93
- Counts against: Promotional0.04
- Counts against: Overclaim0.32
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.76 | 0.60 | 0.84 | 0.73 | 0.24 | +0.24 | +0.176 |
| Reader interest | 0.82 | 0.80 | 0.94 | 0.85 | 0.14 | +0.26 | +0.222 |
| Audience breadth | 0.70 | 0.60 | 0.72 | 0.67 | 0.12 | +0.13 | +0.088 |
| Practical relevance | 0.92 | 0.75 | 0.86 | 0.84 | 0.17 | +0.22 | +0.186 |
| Substantiated | 0.99 | 0.70 | 0.90 | 0.86 | 0.29 | +0.05 | +0.043 |
| Technical depth | 0.99 | 0.85 | 0.96 | 0.94 | 0.14 | +0.05 | +0.047 |
| New information | 0.91 | 0.90 | 0.98 | 0.93 | 0.08 | +0.05 | +0.047 |
| Promotional | 0.05 | 0.05 | 0.01 | 0.04 | 0.04 | −0.19 | −0.007 |
| Overclaim | 0.37 | 0.30 | 0.28 | 0.32 | 0.09 | −0.11 | −0.035 |
| Sum of contributions | +0.766 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.766 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/3/"><img src="https://rubric.hrih.si/badge/2026-10-27/3.svg" alt="Ranked #3 on Rubric, 27 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 4 matches source · 4 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceBenchmark result
Across five flattening harnesses (pi, opencode, Cline, Aider, OpenHands), the forged approval launders into the agent's memory 87–100% of the time, while the four role-typed harnesses show 0%.
The cited source says the same thing.
The article says “Harnesses that flatten roles into text launder 87–100%; harnesses that keep roles typed launder 0%, with no intermediate values”
The source says “Forged `[User]:` line survives compaction — flattening harnesses | **87–100%** | | Same attack on role-typed harnesses (the control) | **0%”
Source cited by the article: github.com/pixee/flat-compaction-attacks-oct-2027
Matches sourceNumber
In the live pi TUI, the full attack chain succeeded in about 50% of poisoned takes (3/6) versus 0 of 5 in the paired clean arm.
The cited source says the same thing.
The article says “The principal result is ~50% end-to-end success against a clean arm that never executed, on the real product”
The source says “End-to-end live in the real product — poisoned vs. clean arms | **3/6 vs. 0/5”
Source cited by the article: github.com/pixee/flat-compaction-attacks-oct-2027
Matches sourceBenchmark result
A code-level provenance check catches 77% of laundering while demoting 2% of legitimate summary content, at the 0.15 setting.
The cited source says the same thing.
The article says “this check, at the 0.15 setting 77% caught, 2% collateral”
The source says “Code-level provenance check: caught / collateral damage | **77% / 2%”
Source cited by the article: github.com/pixee/flat-compaction-attacks-oct-2027
Matches sourceNumber
Laundering stays at 100% from a few thousand tokens up to a ~908,000-token context window, just below the model's 922k input ceiling.
The cited source says the same thing.
The article says “The rate is flat at 100% from a few thousand tokens out to ~908,000”
The source says “Laundering holds at the model's full context window (~908k tokens) | **100%”
Source cited by the article: github.com/pixee/flat-compaction-attacks-oct-2027
No source givenBenchmark result
Gemini CLI's in-prompt anti-injection rule stops only about 13% of laundering on Claude and 25% on GPT, and published classifier defenses reach at best a 67% catch rate.
The article gives no link or citation for it.
The article says “Gemini’s in-prompt rule stops ~13% of laundering on Claude, ~25% on GPT”
The source says No source to compare with.
No source givenNumber
Execution of the attacker's command falls from 5/5 in small windows to 2/5 in windows of ~112k and ~263k tokens, while laundering stays at 5/5.
The article gives no link or citation for it.
The article says “112,000 2/5 5/5”
The source says No source to compare with.
No source givenCausal conclusion
The laundering vulnerability is caused by the harnesses' serialization (flattening roles into text labels) rather than by model limitations.
The article gives no link or citation for it.
The article says “The root cause is a serialization bug in harness code, not a general model limitation”
The source says No source to compare with.
No source givenFirst, only or fastest
Straiker described the laundered-summarization consequence without runtime evidence, and Sleeper demonstrated it only in the persistent-memory channel, so this work is the first executed compaction-channel measurement.
The article gives no link or citation for it.
The article says “this work supplies the missing executed measurement for compaction”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 9 pts, not on front page
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.